Crypto Tracker App on App Store Smuggled Malware, iPhone Wallet Keys Could Be Stolen

A cryptocurrency price tracker available officially on the App Store, FomoPeek, is reported to have contained malicious code in versions 1.1 and 1.2. A joint investigation by SlowMist and OKX Security revealed that the software did not merely display market charts, but hid modules capable of exploiting the iOS kernel, escaping the app sandbox, and decrypting data stored in the Keychain. The findings deal a blow to the assumption that apps from Apple's official store are always safe.

According to SlowMist's report, two secret modules named apptrace and libapptracecore were embedded directly into the App Store package. The modules had no function related to tracking digital asset prices. The kernel exploitation framework used is said to support eight attack methods, selected automatically based on the victim's device model and iOS version. The affected operating system range covers iOS 12.0 to 18.7 as well as iOS 26.0 to 26.1.

Most concerning is the sandbox escape capability. iOS normally isolates each app in a separate container, restricting access to files and data belonging to other apps. The malicious module is reported to have breached that boundary. As a result, malicious code could potentially reach passwords, recovery phrases (seed phrase), private keys (private key), and data from other apps on the same device. SlowMist also warned that the attack function can run automatically at intervals in the background, even if the user never opens the app after installation.

SlowMist traced the version history and concluded the malicious code was introduced on September 9, retained in version 1.2 released on September 12, then removed in version 1.3 on September 17. That means for eight days, users who downloaded from the App Store were at risk of exposure. The research team stressed the analysis was performed on historical IPA files obtained directly from the App Store, not from unofficial sources or re-signed builds. As of the publication of this report, there has been no official statement from Apple regarding a specific patch closing the gap.

"Deleting FomoPeek cannot take back information that may already have been extracted. Like food poisoning, removing the dish from the table does not undo what has already happened," SlowMist warned in its report.

For users who ever installed FomoPeek 1.1 or 1.2, merely deleting the app is not enough. The first step is to stop using the device for sensitive information. Do not enter or view seed phrase, private keys, or exchange credentials on that device. Next, create a new wallet with a fresh recovery phrase on a clean device that FomoPeek never touched, then move crypto assets from potentially exposed addresses. Change all credentials accessible through that iPhone, including Keychain passwords, Apple Notes, browser autofill, messaging apps, and any exchange or wallet services ever accessed. Also check wallet addresses for unauthorized transfers and revoke suspicious token approvals. For high-value wallets, the safest path is to wipe the device entirely and reinstall from a trusted source without restoring sensitive data that may already be compromised.

This incident highlights the gap between marketplace provenance and device-level security. Being listed on the App Store is not a security guarantee, merely a distribution channel. For the Indonesian market, where mobile crypto wallet adoption continues to grow, this event is a reminder that storing assets on a multipurpose phone that also runs dozens of third-party apps carries structural risk. Domestic regulators and industry players need to strengthen security literacy, especially regarding device separation for high-value transactions.

Going forward, the big question is not only how malware could slip past App Store curation, but how quickly the global crypto ecosystem shifts to isolated signing devices or hardware wallet. As long as recovery phrases are still stored on the same phone as everyday apps, gaps like FomoPeek will remain a real threat.